Shane Coughlan

We Held A Meeting To Discuss Three Things:

1. To identify what is happening in the country around open source process management
2.  What we can usefully contribute to increase value in this area for local businesses, projects and government
3. Any areas of concern that might need global community assistance

Watch the Meeting:

Identified Challenges Faced for the OpenChain Germany Work Group:

Our current challenge is a lack of momentum in our meeting schedule and discussions. The challenge appears to be caused by two things:

• Lack of time on everyone’s part
• A wide variety of activities making it difficult to focus energy

Identified Priorities for the German Market:

• Enable small and medium sized businesses (and large) to deal with license compliance
  • What is OpenChain’s specific value proposition for them
• Supply Chain Risk Management:
  • License compliance – ISO/IEC 5230 value proposition
  • Security assurance – ISO/IEC 18974 value proposition
    (value with or apart from IEC 62443)
  • Japanese market solution(s) – why they made SPDX Lite
  • SBOM Quality (Ericsson + Nokia, interest from US government)
• Regulation:
  • Cyber Resilience Act (CRA):
    https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act
    Does ISO/IEC 18974 cover all of this – especially reporting
  • Product Liability Directive:
    https://single-market-economy.ec.europa.eu/single-market/goods/free-movement-sectors/liability-defective-products_en 
  • AI Act:
    https://www.europarl.europa.eu/topics/en/article/20230601STO93804/eu-ai-act-first-regulation-on-artificial-intelligence 
  • Digital Operational Resilience Act (DORA):
    https://www.eiopa.europa.eu/digital-operational-resilience-act-dora_en

Suggested Next Steps: 

• Liaise with Bitkom to collaborate / contribute to their work (Marcel will be the contact):
  https://www.bitkom.org 
• Liaise with Open Business Alliance to collaborate / contribute to their work (Jan will be the contact):
  https://osb-alliance.de
  +
  https://eacg-gmbh.github.io/osba-regulatory-monitor/ 
• Liaise with OSADL to collaborate / contribute to their work (Shane will reach out):
  https://www.osadl.org

Discussion Document:

We have created a document to help everyone share ideas (and refine other ideas) about next steps in the country. You can find and add comments to the document here:

• https://docs.google.com/document/d/1LM9ml2d84oGZUD1lWjD48b-writh4ZswdK85PDy-mtk/edit?tab=t.0#heading=h.9lirpo76pyrg

We Held A Meeting To Discuss Three Things:

1. To identify what is happening in the country around open source process management
2.  What we can usefully contribute to increase value in this area for local businesses, projects and government
3. Any areas of concern that might need global community assistance

Watch the Meeting:

Identified Challenges Faced for the OpenChain India Work Group:

Our current challenge is a lack of momentum in our meeting schedule and discussions. The challenge appears to be caused by two things:

• Lack of time on everyone’s part
• A wide variety of activities making it difficult to focus energy

Identified Priorities for the Indian Market:

• CERT-IN Guidelines (SBOM):
  https://www.cert-in.org.in/PDF/SBOM_Guidelines.pdf 
• SEBI Cybersecurity and Cyber Resilience Framework:
  https://www.sebi.gov.in/legal/circulars/aug-2024/cybersecurity-and-cyber-resilience-framework-cscrf-for-sebi-regulated-entities-res-_85964.htm

Suggested Next Steps:

• Identify where ISO/IEC 5230 and ISO/IEC 18974 can assist
• Identify where OpenChain reference material can assist
• Discuss if we can create new reference material to assist

Discussion Document:

We have created a document to help everyone share ideas (and refine other ideas) about next steps in the country. You can find and add comments to the document here:

• https://docs.google.com/document/d/1rcTKVkwlEybUQMV9Agcs7MoRiCGcp07GqIAXvpA4_cs/edit?tab=t.0#heading=h.jmco3749i6v

We Discussed:

This was a busy meeting. Lead by Chris Wood (Chair, Specification Work Group), and featuring discussions from Martin Yagi (Chair Education Work Group) and Dave Marr (Co-Chair AI Work Group), we worked through the following agenda:

1. Introducing new Work Group Chairs
2. Education Work Group next steps
3. AI Work Group – Draft AI Compliance Guide public comment period
4. Specification Work Group – Approvals for updates to standards
5. and more

Watch the Recording:

Check out the Meeting Slides:

• https://github.com/OpenChain-Project/Meeting-Minutes/tree/main/Slides/2025

Coming Next:

• With concrete targets for implementing agreed updates to the existing standards;
• A new outreach beginning to triage further updates to the existing standards;
• A provisional roadmap for further developing our education material;
• And a six week window before finalizing a new AI compliance guide;

We have full but focused activity ahead.

Join Our Work:

Everyone is welcome to be part of the Specification Work Group. You can join their mailing list here:
https://lists.openchainproject.org/g/specification/

You can find and be part of all OpenChain calls through our participation page here:
https://openchainproject.org/participate

The OpenChain Steering Committee held its Q2 2025 meeting on the 25th of June 2025 to discuss two items:

1. An ISO periodic review to confirm that ISO/IEC 5230 is relevant, used and will continue to be used. The conformation had previously been agreed by email, and was formally motioned and passed at this meeting.
2. Community proposals for future updates to ISO/IEC 5230 and ISO/IEC 18974.

The Outcomes

• (1) The primary change in the updates is adjusting the confirmation of conformance from 18 months to 12 months
• (2) Alongside language improvements and citation or reference improvements

• (3) There will be a ballot to confirm the adjusted standards
• (4) The new versions of the standards will get new ISO numbers

The Recording of the Meeting:

The Slides We Used:

The OpenChain Project had a substantial presence at Open Source Summit North America 2025. We are posting some of our key talks to here to help with community education and discussion.

Expanding the OpenChain Standards Portfolio – More Sister Standards?:

A discussion has opened inside the OpenChain community regarding what future standards may join the existing portfolio of ISO/IEC 5230 for license compliance and ISO/IEC 18974 for security assurance.

The focus of the OpenChain Project is on building trust in the supply chain, and on doing this from the perspective of compliance matters. In the last year, the project has begun to prepare guides for SBOM Quality Management and AI Bill of Material Compliance in the Supply Chain. Both of these read against the project charter and mission.

This talk will explore how these two guides could potentially grown into future ISO standards via the existing practices of the OpenChain Project and lessons learned in making ISO/IEC 18974 in the 2023/2024 period. Rather than announcing new standards, the talk is sharing the processes involved in consideration, to illustrated how open projects address ideas and proposals from all parties in a genuinely inclusive manner.

Slides:

Speakers:

• Shane Coughlan, General Manager of the OpenChain Project

Learn More On The Event Website:

• https://ossna2025.sched.com/event/1zfpo/expanding-the-openchain-standards-portfolio-more-sister-standards-shane-coughlan-the-linux-foundation